Architecture assumptions

Configuration models

• feature_flags: key, enabled, environments[]. An unknown key is default-off; a role card renders only when its controlling flag is enabled and scoped to the running environment.
• geographies: self-referencing tree with a level string, so states/districts/mandals/villages are data, not enum branches.
• role_definitions: code, label, journey_kind, is_public_selectable, feature_flag_key, authority_note. Adding a role is an insert.
• onboarding_step_definitions: per role_code, ordered, with fields[] and evidence_required[] JSON so forms and validation are configuration.

Authorization boundaries

• Roles live only in user_roles, never on profiles, and are read through security-definer helpers (has_role, has_tenant_role, is_tenant_member) to avoid recursive RLS.
• Navigation hides links by role context for usability only; every server function re-checks authority and RLS re-checks row scope.
• Farmer data access stays default-deny and purpose-scoped through has_consent; consumer tier changes throughput, never consent scope.
• Technical tenancy grants no government authority, no support ownership, no FPO membership authority and no blanket farmer-data access.

Onboarding state machine

• Draft → Pending → Activated / Rejected, with Withdrawn as an applicant-side exit. Transitions are validated server-side, not by the client.
• Activation requires a human reviewer role. There is no AI or automatic decisioning anywhere on this path.
• Activation in B0 is allowed only for synthetic applications outside production, behind the onboarding.synthetic_activation flag.

Adapter seams (all mocked)

• Identity/KYC, GIS and payments are interfaces with synthetic implementations. No external call leaves the platform in this slice.
• Government, bank, insurer and employment systems have no implementation yet and are intentionally absent rather than stubbed in UI.

Farmer & assisted onboarding (B2)

• A farmer is never forced into an organisation tenant: farm_records and baseline_consents key off the farmer's own user id.
• Assisted mode records actor and subject separately (assisted_by_user_id / captured_by_user_id) and only field agents, onboarding officers, tenant admins or platform admins may write for another subject.
• Consent is never delegated. baseline_consents and consent_grants are writable only where subject_user_id = auth.uid(), enforced by RLS as well as by server checks.
• Offline parcel drafts live in device storage keyed by client_draft_id, which is also the server-side idempotency key, so a reconnect replay updates the same farm record instead of duplicating it. A different draft claiming a registered plot reference is held as a conflict for a human.
• The jurisdiction identity adapter can only recommend: anything short of 'verified', and any duplicate reference, routes to a manual-review queue that only a platform admin resolves. Captured data is never discarded.
• Baseline platform consent and optional partner consent are separate surfaces; partner cards are identical for first-party and third-party consumers at the same tier.
• Funnel events (onboarding_funnel_events) are analytics only; audit_events remains the security record for consent, role and access decisions.

Deactivated domains

Marketplace transactions, advertising and talent/services journeys are flag-defined but disabled in every environment. They are out of scope until a slice explicitly requires them.